Configure an IPv6 ACE to filter traffic based on Source IPv6 address, Destination IPv6 address, IPv6 next header, and IPv6 traffic class, and routed packets only.
Source IPv6 and destination IPv6 support equal (eq) and mask operators. Next header and traffic class attributes support the equal (eq) operator. The equal to rule operator looks for an exact match with the field defined. If the field matches exactly with the rule, the system will return a match (hit). ACL-based filters provide the mask operator to match on Layer 2, Layer 3, and Layer 4 packet fields. The mask operator is used to mask bits in packet fields during a search or to match on a partial value of a packet field.
The ACL exists with the IPv6 packet type. You can only configure ACE IPv6 attributes to filter on an IPv6 packet.
The ACE exists.
The eq and mask parameters specify an operator for a field match condition: equal to or mask. The mask operator is an implied eq on the mask bits.
enable
configure terminal
filter acl ace <1-2048> <1-2000> [name Word<1–32>]
filter acl ace ipv6 <1-2048> <1-2000> dst–ipv6 eq WORD<0–255>
OR
filter acl ace ipv6 <1-2048> <1-2000> dst-ipv6 mask WORD<1–128> WORD<0–255>
filter acl ace ipv6 <1-2048> <1-2000> src—ipv6 eq WORD<0–255>
OR
filter acl ace ipv6 src-ipv6 <1-2048> <1-2000> mask WORD<1–128> WORD<0–255>
filter acl ace ipv6 <1-2048> <1-2000> nxt-hdr eq {fragment|hop-by-hop|icmpv6|ipsecah|ipsecesp|noHdr|routing|tcp|udp|undefined}
You must configure next header to configure the protocol attributes.
filter acl ace ipv6 <1-2048> <1-2000> traffic-class eq WORD<0–255>
filter acl ace ipv6 <1-2048> <1-2000> routed-only
show filter acl ipv6 <1-2048> <1-2000>
Switch:1(config)#filter acl ace ipv6 15 15 dst-ipv6 eq 30:0:0:0:0:0:0:ffff/64